DO NOT MERGE (gated): proposed comment/apply permissions + security-model candidate

[rowkav09]

Scope

Preparation only for comment/apply slices 3/4. Proposes the App manifest delta (issues: write, contents: write, issue_comment), parity tests, operational permission table and security-model threat boundaries. Existing scan job token remains limited to repository contents: read and checks: write; the proposed content-write token belongs only at the verified dispatch boundary.

Do not merge or activate yet

• M3 stable and slice-2 fix-generation: core eligibility + CLI dry-run preview (comment-apply slice 2) #389 eligibility/preview evidence reviewed, not merely issue-closed.
• ADR 0004 security gate reviewed: separate privileged broker from credential-free untrusted analysis child before activating broader App credentials. This does not claim OS-level isolation or approve dynamic verification.
• Comment handler, canonical render/diff parser, current maintainer permission checks, stale-head checks, signed envelope, and same-repo runner path must be implemented and adversarially tested before enabling comment/apply. Fork apply stays disabled pending a separate live capability test.
• Effective permission detection is a coded acceptance property: if an installation declines issues: write or contents: write reapproval, handlers skip comment/dispatch while existing scans continue. Test this end-to-end; do not assume installation-wide approval.
• Explicit installer reapproval is required for the wider permission ceiling. No App registration or production permission change is part of this PR.

This draft is intentionally not deployable feature code. The manifest parity test checks declared permissions/events only, not handler safety. Do not read a green CI run as evidence those gates have passed. ADR 0003's old current-state prose will need an explicit superseding decision or correction before activation; do not silently rewrite that history here.

Checks

• pnpm --filter @ghostdeps/github-app run test: 194 pass, 0 fail locally.
• Prettier check of changed files and git diff --check pass.
• Seven granular commits preserve each change in history; when gates eventually pass, use rebase merge, not squash.

[rowkav09]

REVIEWED gated draft head 3e89b19365e51b9d4877de30a0e113ccb47bd3ec: the manifest, permission table, event list and security-model amendment are internally aligned as a proposal. The changed-files list is limited to those documents, app.yml and its parity test. Locally, pnpm --filter @ghostdeps/github-app run test passed 194/194, the changed files passed Prettier, and git diff --check passed. This is not a merge or activation approval.

The permission delta is material: contents: write and issues: write raise the installation-wide ceiling, while the manifest itself would subscribe to issue_comment. Comments and dispatch are not implemented in this PR, and the parity test proves only manifest/docs agreement. The actual scan worker still explicitly requests a one-repository contents: read + checks: write token, but the webhook lookup path mints an installation token without the same explicit narrowing, and some existing handlers use context.octokit; audit those paths before any wider registration. The documented declined-reapproval fallback, installation effective-rights detection, narrow dispatch token, comment editor checks, signed envelope, runner and commit credential split remain acceptance gates to implement and adversarially test, not properties demonstrated here. ADR 0003 still describes the old permissions and needs an explicit superseding decision or update before activation, as the PR notes.

Keep this draft and unmerged until the slice-2, ADR/security and implementation gates are met. Re-review the exact head and its live test evidence before any later merge or App registration; neither green CI nor this review establishes those future gates.